bonusxrpl[.]live

This domain operates as a credential-harvesting phishing site targeting cryptocurrency users, specifically those interacting with XRP-related services. The site presents itself as a legitimate wallet or bonus distribution platform, using social engineering tactics to trick visitors into entering private keys, recovery phrases, or login credentials. Once obtained, these sensitive details are transmitted to threat actors, enabling unauthorized access to victims' digital assets and leading to immediate financial theft. The site may also deploy malicious scripts to drain connected wallets automatically upon interaction. Analysis indicates the domain was registered on July 5, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with high-risk domains. It currently resolves to the IP address 104.21.89.202 and holds an SSL certificate issued by Google Trust Services, which provides a false sense of security to potential victims. The domain appears on two security blocklists and is flagged by 4 out of 95 security vendors on VirusTotal, including detection as generic phishing. Despite these indicators, the site remains operational, suggesting ongoing malicious activity. If a user has visited bonusxrpl.live or entered any sensitive information, immediate action is required. Disconnect the device from the internet to prevent further data exfiltration. Revoke any wallet authorizations granted to unknown or suspicious applications via the official wallet interface. Generate a new wallet address and transfer all remaining assets to it, ensuring the old wallet is abandoned. Monitor all connected accounts for unauthorized transactions and report any suspicious activity to the relevant platform. Reset all passwords and enable multi-factor authentication where available. Consider scanning the device with updated security tools to detect and remove any potential malware introduced during the visit.